feat(sense): add reconciliation safety controls [T-012]

deploy/postgres/tests/assertions.sql

@@ -72,7 +72,7 @@ BEGIN
         RAISE EXCEPTION 'sense_app lacks access to its local audit Outbox';
     END IF;
     IF (SELECT max(version) FROM bell.schema_migrations) <> 2
-       OR (SELECT max(version) FROM sense.schema_migrations) <> 4 THEN
+       OR (SELECT max(version) FROM sense.schema_migrations) <> 5 THEN
         RAISE EXCEPTION 'schema migration version drift';
     END IF;
 
@@ -129,9 +129,9 @@ $assertions$;
 
 DO $control_api$
 BEGIN
-    IF NOT has_table_privilege('yovision_t011_sense', 'sense.control_idempotency_receipts', 'SELECT,INSERT,UPDATE,DELETE')
-       OR NOT has_table_privilege('yovision_t011_sense', 'sense.batch_operations', 'SELECT,INSERT,UPDATE,DELETE')
-       OR NOT has_table_privilege('yovision_t011_sense', 'sense.batch_operation_items', 'SELECT,INSERT,UPDATE,DELETE') THEN
+    IF NOT has_table_privilege('yovision_t012_sense', 'sense.control_idempotency_receipts', 'SELECT,INSERT,UPDATE,DELETE')
+       OR NOT has_table_privilege('yovision_t012_sense', 'sense.batch_operations', 'SELECT,INSERT,UPDATE,DELETE')
+       OR NOT has_table_privilege('yovision_t012_sense', 'sense.batch_operation_items', 'SELECT,INSERT,UPDATE,DELETE') THEN
         RAISE EXCEPTION 'Sense runtime lacks Control API table privileges';
     END IF;
     IF has_table_privilege('public', 'sense.control_idempotency_receipts', 'SELECT')
@@ -151,3 +151,31 @@ BEGIN
     END IF;
 END
 $control_api$;
+
+DO $reconcile_safety$
+DECLARE
+    target text;
+BEGIN
+    FOREACH target IN ARRAY ARRAY[
+        'sense.media_path_ownership',
+        'sense.operational_leases',
+        'sense.orphan_scan_runs',
+        'sense.orphan_scan_findings',
+        'sense.orphan_cleanup_actions'
+    ] LOOP
+        IF NOT has_table_privilege('yovision_t012_sense', target, 'SELECT,INSERT,UPDATE,DELETE') THEN
+            RAISE EXCEPTION 'Sense runtime lacks reconciliation safety privilege on %', target;
+        END IF;
+        IF has_table_privilege('public', target, 'SELECT,INSERT,UPDATE,DELETE') THEN
+            RAISE EXCEPTION 'Reconciliation safety state leaked to PUBLIC on %', target;
+        END IF;
+    END LOOP;
+    IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'sense' AND table_name = 'reconcile_state'
+          AND column_name = 'lease_token'
+    ) THEN
+        RAISE EXCEPTION 'reconcile fencing columns are missing';
+    END IF;
+END
+$reconcile_safety$;